Lockbit3 ransomware group lists goodwillnm.org on its leak site

• Ransomware group: Lockbit3
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: August 28, 2022

Lockbit3 claims a data breach at goodwillnm.org

The Lockbit3 ransomware group has listed the domain goodwillnm.org on its dedicated leak site, claiming that a data breach has occurred. This announcement, made on August 28, 2022, indicates that the organization's digital assets may be under threat following the group's claims of unauthorized access.

According to the information provided by the threat actor, the group claims to have successfully gained access to the organization's networks. This access allegedly allowed the attackers to obtain data belonging to the entity. While the listing serves as a public claim of a successful intrusion, the specific details regarding the breach remain limited to the group's announcement on their platform.

Details regarding the alleged data theft

Despite the public listing on the ransomware leak site, there is a significant lack of specific information regarding the contents of the alleged breach. No screenshots have been provided by the group to verify the validity of their claims, and no detailed information regarding the nature of the allegedly leaked data has been released.

The listing does not specify the types of data that have been targeted or exfiltrated. Consequently, the listing names no data types.

About Goodwill Industries of New Mexico

Goodwill Industries of New Mexico is a non-profit organization that operates within the retail and employment support sectors. The organization manages various retail stores that sell second-hand goods. Beyond its retail operations, the entity provides essential vocational training and employment support services to individuals who are seeking work.

Analysis and potential risks of the threat

The Lockbit group is a known threat actor that has been observed since 2019. They are widely recognized for operating under a Ransomware-as-a-Service (RaaS) model, which allows different affiliates to use their infrastructure to conduct attacks. While the group's infrastructure faced a significant disruption due to international operations in February 2024, it has been reported that they have since resumed their operations.

The group's historical methods indicate a preference for a double-extortion strategy. In such scenarios, attackers do not merely encrypt an organization's systems but also steal sensitive information, attempting to exert pressure on the victim by threatening to publish the data publicly. This dual approach increases the pressure on organizations to meet ransom demands to prevent the exposure of their information.

The implications of such a breach can be severe. If the organization's data is indeed leaked, secondary risks may emerge, such as identity theft or the launch of targeted phishing attacks against the organization or its stakeholders. Furthermore, considering the sector in which the organization operates, the exposure of customer data could lead to sanctions under relevant legal regulations.

For organizations operating in similar sectors, maintaining robust cybersecurity postures is critical. This includes implementing strong network segmentation to prevent lateral movement, enforcing multi-factor authentication, and maintaining comprehensive logging to detect unauthorized access early. Because ransomware groups often use the threat of data exposure to drive negotiations, having a verified, offline backup strategy and a clear incident response plan are essential components of a modern defense strategy.